IT Services. Examples of Key Risk Indicators

Transcription

1 IT Services Examples of s ITIL Processes Availability Management, Capacity Management, Covered here Change Management, Configuration Management, IT Service Continuity Management & Financial Management. Status: Release Version: 1.0 Release Date: 28 th August 2006 Author: Dilip R. Mehera

2 Table Of Contents 1. KRIs for ITIL Processes Availability Management Capacity Management Change Management Configuration Management IT Service Continuity Management Financial Management of 13 For training purposes, only

3 1. KRIs for ITIL Processes This chapter serves as a guide on suitable key risk indicators for the ITIL defined processes Availability Management With regard to Availability Management the following metrics and associated targets should be considered: KRI-AVM-1 Using data from the Configuration Management Database (CMDB) indicate any particular Configuration items that are experiencing frequent losses of availability. (for more information on the CMDB refer to the Configuration Management process) Number of CMDB known items that are unavailable Unavailable identical issue every business day, twice or more per week KRI-AVM-2 Number of Incidents logged relating to Availability issues. Incident tickets will be able to provide the following measurements: Detection Time Response Time Repair Time Recovery Time Mean Time to Repair Mean Time Between Failures Mean Time Between System Incidents Detection time, response time, repair time and recovery time could all have defined tolerance values. KRI-AVM-3 Availability Management trend analysis data This should be down by: IT Service IT System IT Component This can be further broken down by using Incident Management to supply the following: Type Category Priority, impact and urgency are risk determining thresholds 1 Created by the British Government (Office of Government Commerce) and widely accepted by commercial organizations across the globe, ITIL is the most widely accepted approach to IT service management. ITIL is a registered mark belonging to the OGC/United Kingdom. 3 of 13 For training purposes, only

4 Priority, Impact & Urgency KRI-AVM-4 The average cost per availability issues Impaired tasks Resources required to resolve/recover time to repair/recover No. of availability issues per day that create operational losses in excess of US$ Business day s total US$ value of operational losses caused by availability issues KRI-AVM-5 What is the client perspective with relation to Availability of IT Services Client satisfaction rating (on Availability issues) A client satisfaction rating below 70% on Availability issues and handling KRI-AVM-6 Availability Management meetings. This will indicate a constant cycle of discussions and process breakdowns. Number of Availability Management meetings held on a weekly basis. No. of Availability Management meetings in excess of 1 per week. KRI-AVM-7 Increased learning and growth. This refers to the interaction with other processes, staffing, training and investments in software and hardware. No. of Availability Management staff in a country Average number of (appropriate) professional courses taken by an AM staff member Tolerance is a minimum of 1 course taken per year, per AV staff member. Note: Be wary of using percentages in too many cases. It may even be better to use absolute values when the potential number of maximum failures is less than of 13 For training purposes, only

5 3.2 Capacity Management With regard to Capacity Management the following metrics and associated targets should be considered: KRI-CPM-1 Using data from the Configuration Management Database (CMDB) indicate any particular Configuration items that are experiencing frequent losses or degradation of service due to capacity issues. Number of Incidents logged relating to Capacity issues. Identical capacity issue each business day, twice or more per week. KRI-CPM-2 Capacity Management Trend Analysis This should be done by: Business Capacity IT Service Capacity IT System Capacity IT Component Capacity This can be further broken down by using Incident management to supply the following: Type Category Priority, Impact, Urgency KRI-CPM-3 The average cost per capacity issue This should be done by: Business Capacity IT Service Capacity IT System Capacity IT Component Capacity Detection time, response time, repair time and recovery time could all have defined tolerance values. Reporting threshold is where the average cost per issue is in excess of US$ 10,000. over the period of 1 calendar month. KRI-CPM-4 What is the client perspective with relation to Capacity of IT Services? This KPI should be responded to once every month by the client and a value High-7 be considered as the lower tolerance value. There are distinct advantages with the above scale of measurement: 1. It is more granular than 1 to 3, or 1 to 5, or Low/ Medium/ High, or a GYR color scheme. 2. It supports an exact middle instance. 5 of 13 For training purposes, only

6 3. It supports color, numbering and H/M/L. 4. It allows for ranking within the color and H/M/L spectrum. KRI-CPM-5 Number of Capacity Management meetings. Number of Capacity Management meetings held on a monthly basis. No. of Availability Management meetings in excess of 2 per month. One such meeting a month will indicate a constant cycle of discussions. Having more than two such meetings per month for a specific environment (e.g. major/critical application, server farm or site) would suggest need for improvement. 6 of 13 For training purposes, only

7 3.3 Change Management With regard to Change Management the following metrics and associated targets should be considered: KRI-CHM-1 Using data from the Configuration Management Database (CMDB) indicate any particular Configuration items that are going through continual Change. Number of Change issues relating to the same, specific application or physical environment. Identical Change issue requested every Change- Cycle thrice-in-a-row; or requested as an Emergency-Change (EC) thrice or more within any 5 day period. KRI-CHM-2 Change management trend analysis. Number of RFC s raised Successful Changes made Number of Changes rejected Number of Changes reversed (with rational as to why). KRI-CHM-3 Level of environment robustness and soundness. Incident count related to Changes made in the previous period. Threshold values for risk reporting purposes should be established for the number of Changes rejected and Changes reversed per Change-Cycle. Following Change Management trend gathering over at least a 3-month period for a particular environment, an upper threshold incident count of RFCs raised per month should be set. KRI-CHM-4 Potential of unauthorized or inappropriate Change to production environment. Number of Change (post) reviews, and Change peer-reviews performed. All implemented RFCs/ECs must have either a post Change review or peer-review conducted within 5 days of their production deployment. KRI-CHM-5 Potential backlog situation and/ or poor Change Management planning, Forward Schedule of Changes (FSC) prior to each Change cycle has been completed and provided to the Service Desk. Boolean value per Change cycle. 7 of 13 For training purposes, only

8 3.4 Configuration Management With regard to Configuration Management the following metrics and associated targets should be considered: KRI-CFM-1 Configuration Management Database (CMDB) contained entry information mismatches following a validation exercise. Simple count on number of times that a configuration does not match held information. Dependent on the size (i.e. total number of record entries in CMDB), a tolerance target as follows could be set: 12 per audit 6 per month. KRI-CFM-2 Elapsed time between Change approval and it s implementation. Amount of elapsed time expressed in calendar days = (date of Change implementation date of RFC registration). 3 weeks from date of RFC registration, for minor category changes 1 week from date of RFC registration, for all other category changes except Emergency Changes KRI-CFM-3 Unauthorized components in the CMDB. The number of components that are identified as unauthorized over a given period of time: for Production Control; for Accounts. Following determination of the given period of time (e.g. over 2 weeks, or 1 month span). 0 for Production Control; 3 for Accounts. KRI-CFM-4 The changing amount of SEV1 (highest level of severity) incidents reported to Help Desk. Track reduction over (defined and agreed-to) timeframe. 5% reduction on SEV1 calls over first quarter, next financial year. KRI-CFM-5 Using CMDB information to determine the average time to assess and resolve Service Desk calls. Delta in the average time to assess and resolve Service Desk calls (using CMDB data). Threshold could be set to: the average call resolution time dropping from 3 minutes to 2.5 minutes within an 8 weeks span. KRI-CFM-6 Service Level Agreement breaches resulting from poor/missing linked Service Support processes. Number of breaches to Service Level Agreement that occur as a result of poor or missing information from the closely linked Service Support functions; namely, Configuration Mgmt., Release Mgmt., Problem Mgmt. and Service Desk. Dependent on the size of the account and the nature of its business, a tolerance target could be: Not more than 1 SLA breach per calendar month resultant from lacking/ineffective linked Service Support functions. 8 of 13 For training purposes, only

9 KRI-CFM-7 Problems and incidents resultant from a configuration change. Number of times that a configuration change results in increased incidents and problems. Count of instances where the source of problems and incidents is isolated to being a configuration change. Dependent on the either nature of the Production environment or characteristics of an Account s business, a tolerance target could be: Production Control: Count of not more than 5%.. Accounts: Count of not more than 15%. of configuration Changes deployed (in production) for a given Change Mgmt. cycle should directly lead to subsequent problems and incidents. KRI-CFM-8 Failed Change caused by insufficient or incorrect information supplied from the CMDB. The number of times that a change was not completed due to insufficient or incorrect information supplied from the CMDB. Following determination of the given period of time (e.g. over 2 weeks, or 1 month span). 0 for Production Control; 3 for Accounts. KRI-CFM-9 CMDB entries found to be in error. Absolute value count on the amount of times the CMDB is found to be in error. On a monthly basis the absolute value count. 9 of 13 For training purposes, only

10 3.5 IT Service Continuity Management With regard to IT Service Continuity Management the following metrics and associated targets should be considered: KRI-COM-1 Risks of the nature that the organization has an element of control over. Dependency on mission (incl. financial reporting) critical business systems. Year-on-year count of the increasing number of business systems the organization depends upon. KRI-COM-2 Risks of the nature that the organization has no element of control over. Count of impacting natural disasters and politically destabilizing activities. Year-on-year count of the increasing number of natural disasters and politically destabilizing activities impacting the organization s IT service continuity. KRI-COM-3 IT Service performance review meetings (held on time). Number count of such meetings held each quarter. A reducing number here may be a good indication or at least the number should be stable. KRI-COM-4 IT Service Continuity Management (ITSCM) cost index. Costs of [IT Service Continuity processing (decreasing)] vs. [level of expected IT service (increasing)]. Calculated and resultant index value should always be 1.0 or less. KRI-COM-5 ITSCM invocation count. The number of invocations of the ITSCM plan or elements of such plans. Daily tolerance values should be set for the triggering of ITSCM for each of the following: loss, damage or denial of access to key Infrastructure services failure or non-performance of critical providers, distributors or other third parties loss or corruption of key information sabotage, extortion or commercial espionage deliberate infiltration or attack on critical information systems. 10 of 13 For training purposes, only

11 KRI-COM-6 Number of Change Requests detected that should have resulted in an immediate change to the ITSCM plan but did not! Count of ITSCM plan changes post originating CR implementation period-validity. Following determination of the given period of time (e.g. over 2 weeks, or 1 month span). 0 for Production Control; 1 for Accounts. 11 of 13 For training purposes, only

12 3.6 Financial Management With regard to Financial Management the following metrics and associated targets should be considered: KRI-FIM-1 Effective stewardship of the IT finances. The indicators in the adjacent column need to be set up for each account. Increased accuracy of cost recovery profiles and expenditure. The supporting IT organization is operated within the expected income/level of profits. The IT financial objective of either breakeven or profit (whichever is the objective of the unit) is met. Increased accuracy of monthly, quarterly and annual forecasted profiles. Reduced frequency and severity of manual changes required to the Accounting and Budgeting systems. All IT costs are accounted-for. Reduced frequency and severity of Changes made to the Charging algorithms (where appropriate). Timely production of budget forecasts, plans and reports. Timely production of the Financial Plan, IT accounts and reports. To be determined on an account for account basis; driven by total contract value (TCV), complexity of services and business; spread across multiple countries, etc. KRI-FIM-2 Overall effectiveness of the Financial Management process. Specified reports produced at the required time. The inventory schedules are kept up-todate. Timeliness of annual financial audits. Meeting of monthly, quarterly and annual financial objectives. Reduction in the relative costs. Reduction in the number of budget variances and adjustments. To be determined on an account for account basis; driven by total contract value (TCV), complexity of services and business; spread across multiple countries, etc. 12 of 13 For training purposes, only

13 Reduction in the variances from the Financial Plan. Relative reduction in the overall Total Cost of Ownership (TCO). KRI-FIM-3 Risks associated with customer s dissatisfaction with cost of provisioning. Charges, where applied, are seen to be fair. Reduction in the number queries and complaints from Customers relating to the calculation of IT costs and charges. Tolerance is no negative response expected from customer to the question raised as to whether the applied IT service charges are deemed fair. Tolerance of no more than 3 complaints per customer satisfaction survey in conjunction with the calculation of IT costs and charges. 13 of 13 For training purposes, only